It was discovered that ejabberd, a Jabber/XMPP server, uses SSLv2 and weak ciphers for communication, which are considered insecure. The software offers no runtime configuration options to disable these. This update disables the use of SSLv2 and weak ciphers. The updated package for Debian 7 (wheezy) also contains auxiliary bugfixes originally staged for the next stable point release.

For the oldstable distribution (squeeze), this problem has been fixed in version 2.1.5-3+squeeze2. For the stable distribution (wheezy), this problem has been fixed in version 2.1.10-4+deb7u1. For the testing distribution (jessie), and unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your ejabberd packages.

ejabberd is a distributed, fault-tolerant Jabber/XMPP server written in Erlang. Its features contain: - XMPP-compliant - Web based administration - Load balancing: can run in a cluster of machines - Fault-tolerance: database can be replicated and stored on multiple nodes (nodes can be added or replaced 'on the fly') - Virtual hosting: several virtual domains can be served using single ejabberd instance - SSL/TLS support - Multi-User Chat (MUC/conference) - IRC transport - Jabber Users Directory, based on users vCards - Service Discovery - Shared roster

ejabberd on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2013/dsa-2775.html

---

Updated on 2015-03-25